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DETAILED ACTION 

Claims 1-33 have been examined and are pending. 

Information Disclosure Statement 
The IDS submitted by the applicant has been considered. 

Drawings 

The drawings are objected to because in Fig 1, item 40 is disclosed in the 
specification as being a Directed Acyclic Graph (DAG) on p6, lines 19-25. The 
examiner respectfully asserts that item 40 as represented in Fig 1 shows an Undirected 
Graph. Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in 
reply to the Office action to avoid abandonment of the application. Any amended 
replacement drawing sheet should include all of the figures appearing on the immediate 
prior version of the sheet, even if only one figure is being amended. The figure or figure 
number of an amended drawing should not be labeled as "amended." If a drawing figure 
is to be canceled, the appropriate figure must be removed from the replacement sheet, 
and where necessary, the remaining figures must be renumbered and appropriate 
changes made to the brief description of the several views of the drawings for 
consistency. Additional replacement sheets may be necessary to show the renumbering 
of the remaining figures. Each drawing sheet submitted after the filing date of an 
application must be labeled in the top margin as either "Replacement Sheet" or "New 
Sheet" pursuant to 37 CFR 1 .121(d). If the changes are not accepted by the examiner, 
the applicant will be notified and informed of any required corrective action in the next 
Office action. The objection to the drawings will not be held in abeyance. 
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Specification 

The disclosure is objected to because of the following informalities: On page 11, 
lines 4-5, the examiner respectfully suggests that the applicant use commas where 
necessary so as to make the cited sentence more coherent when read. Also, in the 
same sentence, the examiner believes that the applicant meant to use "its" instead of 
"it's." For example, "...a set of ACL's inherited by an item, whose item identity is an 
ItemID, from its parents in the store." 

Appropriate correction is required. 

Claim Objections 
Claim 20 is objected to because of the following informalities: 
1. As per claim 20, "...comprising a component to at least one of create..." doesn't 
make sense. The examiner believes that the applicant meant to recite 
"...comprising a component to at least do one of the following: create...." 
Appropriate correction is required. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 2-11, 19, 27, and 33 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 
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Claims 2-11, 19, 27, and 33 each lacks a transition phrase after the preamble of 
each claim that renders each claim indefinite. 

Claim 4 recites the limitation "the database" in line 2. There is insufficient 
antecedent basis for this limitation in the claim. The examiner notes that a data store 
contains database files. However, it is unclear if there is more than one database 
contained by the data store of claim 1 and if there is, to which database claim 4 is 
referring. 

Claim 33 recites the limitation "the security table" in line 1 . There is insufficient 
antecedent basis for this limitation in the claim. 
Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 1-20, 22-29, and 33 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 
Claim 1: 

Claim 1 refers to a data storage security system comprising at least one 
hierarchical data structure and a security component. The examiner asserts that a data 
structure no matter how it is arranged is still just software. Further, on page 6, lines 5-8 
of the specification, the applicant disclosed that the term "component" and "system" 
could refer to just software or software in execution. The security policy applied by the 
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security component can be defined by software alone. The data items referred to in 
claim 1 also can be software alone. Also, the data store referred to in claim 1 also can 
be implemented as software alone. As such, the security component referred to in the 
claim reads on just software. Thus no tangible subject matter is disclosed by claim 1 . 
The examiner notes that the applicant can easily fix this 101 problem by reciting in the 
preamble instead "A data storage security system using a computer" as the applicant 
discloses in the specification on p22 the environment in which the invention can be used 
includes a computer. 
Claim 2: 

Claim 2 further defines the data structure of claim 1 . No tangible subject matter 
is disclosed. 
Claim 3: 

Claim 3 further defines the data structure of claim 2. No tangible subject matter 
is disclosed. 
Claim 4: 

Claim 4 recites a further step implemented by the software security component of 
claim 1 . No tangible subject matter is disclosed. 
Claim 5: 

Claim 5 further defines the software security policy of claim 4. No tangible 
subject matter is disclosed. 
Claim 6: 
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Claim 6 further defines the software security policy of claim 1 . No tangible 
subject matter is disclosed. 
Claim 7: 

Claim 7 discloses the software security component includes an Access Control 
List having one or more Access Control Entries. A list is a software data structure and 
the entries in a list are also just software entries. No tangible subject matter is 
disclosed. 
Claim 8: 

Claim 8 further defines the software list of claim 7. No tangible subject matter is 
disclosed. 
Claim 9: 

Claim 9 refers to a plurality of Access Control Lists, which is still just software. 
No tangible subject matter is disclosed. 
Claim 10: 

Claim 10 refers to the software security component specifying a set of principals. 
The examiner asserts that the principals are software principals. No tangible subject 
matter is disclosed. 
Claim 11: 

Claim 1 1 refers to the security component of claim 1 including lists and a security 
identifier. Lists are abstract data structures. A security identifier can be implemented in 
just software. No tangible subject matter is disclosed. 
Claim 12: 
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Claim 12 refers to an ordering component. As discussed in claim 1, a 
component in the applicant's invention can refer to just software, so no tangible subject 
matter is disclosed. 
Claims 13 and 14: 

Claims 13 and 14 each refers to an ordering algorithm. An algorithm is an 
abstract idea and is not statutory subject matter. 
Claim 15: 

Claim 15 refers to a software component. No tangible subject matter is 
disclosed. 
Claim 16: 

Claim 16 refers to the software security component further comprise a software 
list. No tangible subject matter is disclosed. 
Claim 17: 

Claim 17 refers to the software security component further comprises an access 
mask. The access mask is disclosed on p16, lines 13-19 and is a software access 
mask. No tangible subject matter is disclosed. 
Claim 18: 

"Functional descriptive material" consists of data structures and computer 
programs which impart functionality when employed as a computer component. The 
definition of "data structure" is a "physical or logical relationship among data elements, 
designed to support specific data manipulation functions." "Nonfunctional descriptive 
material" includes but is not limited to music, literary works and compilation, or mere 
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arrangement of data. The examiner asserts that claim 18 as recited imparts no 
functionality when employed as a computer component. The security table as disclosed 
on p18, lines 2-16 is a mere arrangement of data. 
Claim 19: 

Claim 19 refers to fields that the security table can include. The examiner 
asserts that the fields as recited are abstract ideas (i.e. variables) and are non-statutory 
subject matter. 
Claim 20: 

Claim 20 refers to a component which executes the steps of the algorithm as 
disclosed in the specification on p19, line 4-p21 , line 4. The examiner asserts that the 
algorithm disclosed can be performed by a software component alone. No tangible 
subject matter is disclosed. 
Claim 22: 

Claim 22 refers to a method to facilitate data item security. The steps of the 
method are disclosed in the specification on p21 , lines 5-29 and Fig 7. The examiner 
asserts that no tangible subject matter is disclosed in the specification as needed to 
perform the steps of the security process. As such, claim 23 reads on a method that 
can be performed by software alone. 
Claims 23-28: 

Claims 23-28 recite further steps and features of the software method associated 
with claim 22. 
Claim 29: 
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Claim 29 is the means version of claim 22. No tangible subject matter is 
disclosed. 
Claim 33: 

Claim 33 refers to the fields of a security table. The examiner asserts that the 
fields recited in claim 33 are abstract ideas (i.e. variables) and as such are non-statutory 
subject matter. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

Claims 1-4, 6-7, 10-11, 21-22, 25-27, and 29-32 are rejected under 35 
U.S.C. 102(e) as being anticipated by Belani et al (US 6,772,350). 
Claim 1: 

Belani discloses a data storage security system, comprising: 
1 . At least one hierarchical data structure associated with one or more data items 
(col 3, lines 39-43; col 4, lines 55-57; and col 6, lines 50-61). 
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2. A security component that applies at least one security policy to the data items 
from a global location associated with a data store (col 2, lines 60-63 and col 6, 
lines 50-61). 
Claim 2: 

Belani further discloses the hierarchical data structure is at least one of a tree 
structure and a containment hierarchy (Fig 5 and col 8, lines 15-26). 
Claim 3: 

Belani further discloses the containment hierarchy is modeled as a Directed 
Acyclic Graph (DAG) (col 8, lines 15-26; Fig 5 and Fig 6). 
Claim 4: 

Belani further discloses the security policy is mapped to one or more security , 
regions that are associated with a database (col 6, lines 50-61 and col 9, lines 51-59). 
Claim 6: 

Belani further discloses the security policy is at least one of inherited by an item 
(col 6, lines 50-61). Belani does not explicitly disclose the security policy is at least one 
of explicitly mapped to an item. However, it is inherent that at least one item has a 
security policy explicitly mapped to the item. If this were not the case, then there would 
not be security policy for an item further down the hierarchy to inherit. 
Claim 7: 

Belani further discloses the security component includes an Access Control List 
having one or more Access Control Entries (col 6, lines 63-col 7, line 4). 
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Claim 10: 

Belani further discloses the security component specifies a set of principals that 
are granted or denied access to perform operations on an item (col 7, lines 1-4). 
Claim 11: 

Belani further discloses the security component includes at least one of 
discretionary access control list, a system access control list, and a security identifier 
(col 5, lines 8-12 and col 6, lines 63-66). 
Claim 21: 

Belani does not explicitly define a computer readable medium having computer 
readable instructions stored thereon for implementing the security component of claim 
1 . However, Belani's system is disclosed as being used with a computer system (col 1 , 
lines 10-13). As such, a computer readable medium having computer readable 
instructions stored thereon for implementing the security component of claim 1 must 
inherently exist. 
Claim 22: 

Belani discloses a method to facilitate data item security, comprising: 

1 . Defining at least one security policy for a hierarchical data structure (col 8, lines 
15-26). 

2. Defining at least one security region for the hierarchical data structure (col 8, 
lines 15-26 and col 9, lines 52-59). 

3. Applying the security policy to the hierarchical data structure from the security 
region (col 8, lines 15-26). 
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Claim 25: 

Belani further discloses processing security policies for at least one of a tree 
structure and a containment hierarchy (Fig 5; col 6, lines 50-62; and col 8, lines 15-26). 
Claim 26: 

Belani further discloses mapping security policy to a security region from a 
remote location from a database (col 2, lines 59-64 and 59-61). 
Claim 27: 

Belani further discloses the security policy is associated with an Access Control 
List having one or more Access Control Entries (col 6, lines 50-55). 
Claim 29: 

Claim 29 is the means version of claim 22 and is rejected for the same reasons. 
Claim 30: 

Belani discloses a computer readable medium having a data structure stored 
thereon, comprising: 

1 . A first data field related to a security region associated with a hierarchical data 
structure (col 6, lines 63-66). 

2. A second data field that relates to a security policy (col 6, lines 50-62). 

Belani does not explicitly disclose a third data field that links the security policy to 
the security region. However, this third field must inherently exist or there would be no 
way to associate the security region with a security policy. 
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Claim 31: 

Belani further discloses a field for an access mask specifying at least one of 
object-specific access rights, standard access rights, and generic access rights (col 7, 
lines 42-48 and Fig 4). 
Claim 32: 

Belani does not explicitly disclose a security field for similarly protected security 
regions. However, one must inherently exist or similarly protected security regions 
would not have similar security policies. The examiner believes that the second data 
field disclosed in claim 30 also reads on this limitation. 



Claim Rejections - 35 USC § 103 

Claims 5, 12-17, 23-24, and 28 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Belani et al (US 6,772,350) in view of Dennis et al (US 6,466,932). 
Claim 5: 

Belani further discloses the security policy is mapped from within the database 
(col 6, lines 50-61). Belani does not explicitly disclose the security policy is mapped 
from outside the data store. 

However, Dennis discloses the security policy is mapped from outside the data 
store, i.e. an administrator defines the policy explicitly (col 7, lines 15-21). It would have 
been obvious to one of ordinary skill in the art at the time the applicant's invention was 
made to incorporate Dennis's teachings with Belani's according to the limitation recited 
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in claim 5. One of ordinary skills would have been motivated to do so as Dennis's 
teachings allow for a way for an administrator to handle any conflicting policies and to 
manually set group security policies (col 7, lines 7-21). 
Claim 12: 

Belani does not explicitly disclose an ordering component that arranges one or 
more Access Control Entries (ACE) in an Access Control List (ACL) to determine a 
security policy that is enforced for an item. However, Dennis discloses this limitation 
(col 7, lines 7-11 and col 8, lines 26-31). 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made in light of Dennis's teachings to further modify the 
system disclosed by Belani according to the limitations recited in claim 12. One of 
ordinary skill would have been motivated to do so as Dennis teaches that it would allow 
for a way to handle conflicting policies (col 7, lines 7-11). 
Claim 13: 

Belani and Dennis do not explicitly disclose the ordering algorithm as recited in 
claim 13. However, Belani discloses inherited ACL's on an item (col 8, lines 63-66). 
Further, Dennis discloses ranking the security policies in an access list (col 8, lines 26- 
31) which reads on the algorithm as recited in claim 13. 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made to have incorporated Dennis's teachings into the 
combination system of Belani and Dennis according to the limitations recited in claim 
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13. One of ordinary skill would have been motivated to do so for the same reasons 
given in claim 12. 

Claim 14: 

Belani and Dennis do not explicitly disclose the ordering algorithm as recited in 
claim 14. However, Belani discloses inherited ACL's on an item (col 8, lines 63-66). 
Further, Dennis discloses ranking the security policies in an access list (col 8, lines 26- 
31). This also reads on the limitation recited in claim 14. 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made to have incorporated Dennis's teachings into the 
combination system of Belani and Dennis according to the limitations recited in claim 

14. One of ordinary skill would have been motivated to do so for the same reasons 
given in claim 12. 

Claim 15: 

Belani and Dennis do not explicitly disclose further comprising a component that 
evaluates access rights for a given principal to a given item. However, Belani discloses 
that access to an item or resource is restricted by users and the users are limited to 
certain types of access (col 6, line 63-col 7, line 4). Therefore, there must exist a 
component in Belani's system that evaluates access rights for a given principal to a 
given item. 
Claim 16: 

Belani does not disclose the security component further comprises an effective 
access control list that is obtained by processing lists inherited by an item and adding 
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inheritable access control entries in an explicit access control list. However, Dennis 
discloses the security policy of an item can be inherited from previous lists and an 
administrator explicitly defining additional security policies for the item. 

In light of this teaching by Dennis, it would have been obvious to one of ordinary 
skill in the art at the time the applicant's invention as made to further modify the 
combination system of Belani and Dennis according to the limitation recited in claim 16. 
One of ordinary skill would have been motivated to do so for the same reasons given in 
claim 5. 
Claim 17: 

Belani further discloses the security component further comprises an access 
mask specifying at least one of object-specific access rights, standard access rights, 
and generic access rights (col 7, lines 42-48 and Fig 4). 
Claim 23: 

Belani discloses automatically supporting at least one inherited security policy 
(col 8, lines 56-66). Belani does not explicitly disclose automatically supporting at least 
one explicit security policy. However, Dennis discloses automatically supporting at least 
one explicit security policy (col 7, lines 15-21). 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made to further modify Belani's method according to the 
limitation recited in claim 23 in light of Dennis's teachings. One of ordinary skill would 
have been motivated to incorporate Dennis's teachings for the same reason given in 
claim 5. 
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Claim 24: 

Belani does not explicitly disclose the method further comprising automatically 
ordering security policies. However, Dennis discloses this limitation (col 8, lines 26-31). 
It would have been obvious to one of ordinary skill in light of this teaching to further 
modify Belani's method according the limitation recited in claim 24. One of ordinary skill 
would have been motivate to do so for the same reason given in claim 12. 
Claim 28: 

Belani does not explicitly disclose automatically arranging one or more Access 
Control Entries in the Access Control List to determine a security policy that is enforced 
for an item. However, Dennis discloses this limitation (col 8, lines 26-31). 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made in light of Dennis's teachings to further modify Belani's 
method according to the limitation recited in claim 28. One of ordinary skill would have 
been motivated to do so for the same reasons given in claim 12. 

Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over Belani et 
al (US 6,772,350) in view of applicant's admittance of prior art. 
Claim 8: 

Belani discloses an Access Control list associated with a containment hierarchy 
(Fig 5; col 6, lines 63-col 7, line 4; and col 8, lines 15-26). Belani does not explicitly 
disclose the Access Control List can be associated with a holding relationship of a 
containment hierarchy. 
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However, the applicant disclosed on in the specification that it was known in the 
art at the time the applicant's invention was made that an Access Control can be 
associated with every file or directory in a hierarchy (p2, lines 2-7). The examiner 
asserts that a file located in a directory constitutes a holding relationship as the directory 
holds the file. 

It would have been obvious to one of ordinary skill in the art to modify Belani's 
system according to the limitation recited in claim 8. One of ordinary skill would have 
done so because the applicant admitted that it was known in the art that doing so would 
provide support for specifying a default ACL for newly created in items in a directory 
(p2, lines 4-7). 

Claims 9 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Belani et al (US 6,772,350) in view of applicant's admittance of prior art and further in 
view of Dennis et al (US 6,466,932). 
Claim 9: 

Belani does not explicitly disclose a plurality of Access Control Lists (i.e. group 
policy objects) to facilitate security for the containment of hierarchy. However, Dennis 
discloses a plurality of Access Control Lists to facilitate security for the containment 
hierarchy (col 2, lines 3-7). 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made to further modify Belani's system according to the 
limitation recited in claim 9. One of ordinary skill would have done so because Dennis 
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discloses that it would have allowed for each ACL (policy objects) to be associated with 
different hierarchically-organized directory objects/regions (col 2, lines 3-7). 
Claim 20: 

Belani do not explicitly disclose a component to do at least one of the following: 
create a new item in a container, add an explicit ACL to an item, add a holding link to an 
item, delete a holding link from an item, delete an explicit ACL from an item and modify 
an ACL associated with an item. 

However, the use of folders/directories in operating systems was known in the art 
at the time the applicant's invention was made. This was admitted by the applicant in 
the specification (p1 , lines 9-20). A directory reads on a container and it was known 
that one could create a new item or file in a directory. When you create or place an item 
in a directory, you are using what is known as a "holding link" as the folder holds the 
item. When an item is deleted or moved, the holding link the item had with the folder is 
deleted. The applicant also admitted that it was known in the art that a file has an ACL 
associated with it (p2, paragraph 2). It was also known that when the file is moved from 
one directory to another, the ACL for the file can be updated — i.e. modified or deleted 
and replaced with a new ACL (p2, lines 15-17). Further, Dennis discloses adding an 
explicit ACL to an item (col 7, lines 15-21). 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made to further modify Belani's system according to the 
limitations recited in claim 20. One of ordinary skill would have been motivated to 
incorporate the previous known art because it would be a starting point for 
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improvements via the teachings as disclosed by Belani. One of ordinary skill would be 
motivated to incorporate Dennis's teachings of an explicit ACL for an item according to 
the limitations recited in claim 20 for the same reasons given in claim 5. 



Claims 18-19 and 33 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Belani et al (US 6,772,350) in view of Sandler et al (US 2003/0217033). 
Claim 18: 

Belani further discloses similarly protected security regions (col 9, lines 52,-59). 
Belani does not explicitly disclose a security table for similarly protected security 
regions. However, there must be some sort of database used to keep track of the 
similarly protected security regions disclosed by Belani. Further, Sandler discloses that 
data in a database management system are typically stored in the form of records, 
which are typically presented logically in the form of a table (p1 , paragraph 0002 and 
Fig 13A). 

In light of Sandler's disclosure, it would have been obvious to one of ordinary skill 
in the art to further modify Belani's system according to the limitation recited in claim 18. 
One of ordinary skill would have done so because of typical practice in the art-Sandier 
discloses that a table is typically used to organize data in a database (p1 , paragraph 
0002) and Belani's system must have some sort of security database to keep track of 
the similarly protected security regions, therefore typically the security data would be 
organized in a security table. 
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Claim 19: 

Belani and Sandler do not explicitly disclose the security table includes at least 
one of the following fields: an Item Identity, an Item Ordpath, an Explicit Item, a Path 
ACL, and a Region ACL. However, Sandler discloses that data in a database 
management system are typically stored in the form of records, which are typically 
presented logically in the form of a table and attributes as the columns, i.e. record fields 
(p1, paragraph 0002 and Fig 13A). The tables as seen in Fig 13A have record fields 
which reads on the fields recited in claim 19. 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made in light of common practice in the art of databases as 
disclosed by Sandler to further modify Belani's system according to the limitation recited 
in claim 19. One of ordinary skill would have been motivated to do so for the same 
reason given in claim 18. 
Claim 33: 

Belani does not explicitly disclose a security table field includes at least one of an 
Item identity, an Ordpath, an Explicit Item, a Path ACL, and a Region ACL. However, 
Sandler discloses that data in a database management system are typically stored in 
the form of records, which are typically presented logically in the form of a table and 
attributes as the columns, i.e. record fields (p1, paragraph 0002 and Fig 13A). The 
tables as seen in Fig 13A have record fields which reads on the fields recited in claim 
33. 



Application/Control Number: 10/691,999 Page 22 

Art Unit: 2135 

It would have been obvious to one of ordinary skill in the art at the time the 
applicant's invention was made in light of common practice in the art of databases as 
disclosed by Sandler to further modify Belani's system according to the limitation recited 
in claim 33. One of ordinary skill would have been motivated to do so for the same 
reason given in claim 18. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ponnoreay Pich whose telephone number is 571-272- 
7962. The examiner can normally be reached on 8:00am-4:30pm Mon-Fri. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 571-272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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